CVE-2026-82524 unopim CVE debrief

Who should care

System administrators and security teams managing UnoPim installations, especially those with administrative access, should be aware of this vulnerability and take immediate action to secure their systems. They should review and restrict file upload capabilities, especially for PHP files, and verify TinyMCE configurations.

Technical summary

UnoPim before 2.1.5 contains an authenticated file upload vulnerability allowing authenticated administrators to upload arbitrary PHP files via the TinyMCE image upload endpoint due to missing file extension and MIME type validation. This could lead to arbitrary code execution on the server. The vulnerability is caused by insufficient validation of file uploads, which can be exploited by uploading a PHP web shell to the public storage disk and executing arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response. Attackers can leverage this vulnerability to gain control over the server and execute malicious code.

Defensive priority

Authenticated administrators should urgently review and restrict file upload capabilities, especially for PHP files, and verify TinyMCE configurations.

Recommended defensive actions

• Restrict file uploads to only allow specific file types and validate MIME types.
• Implement additional security controls for the TinyMCE image upload endpoint.
• Monitor for suspicious file uploads and system changes.
• Update UnoPim to version 2.1.5 or later.
• Review and restrict administrative access to prevent exploitation.
• Perform vulnerability scanning to identify potentially exposed systems.
• Review system logs for indicators of compromise related to the vulnerability.

Evidence notes

Evidence is limited; primary official records indicate an authenticated file upload vulnerability in UnoPim before 2.1.5, allowing arbitrary PHP file uploads via TinyMCE image upload endpoint. Defenders should verify UnoPim version, review TinyMCE configurations, and monitor for suspicious file uploads and system changes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.